next@12.2.4-canary.11 vulnerabilities

The React Framework

Direct Vulnerabilities

Known vulnerabilities in the next package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Resource Exhaustion

next is a react framework.

Affected versions of this package are vulnerable to Resource Exhaustion via the cache-control header. An attacker can cause a denial of service to all users requesting the same URL via a CDN by caching empty prefetch responses.

How to fix Resource Exhaustion?

Upgrade next to version 13.4.20-canary.13 or higher.

<13.4.20-canary.13
  • M
Uncaught Exception

next is a react framework.

Affected versions of this package are vulnerable to Uncaught Exception due to specific requests that can cause an unhandledRejection in the server which can crash the process in specific Node.js versions with strict unhandledRejection handling.

Note: Applications are only vulnerable if they:

  1. are using a Node.js version that is above v15.0.0

  2. are using next start or a custom server

Users are not affected if they are using deployments on Vercel along with similar environments where next-server isn't being shared across requests.

How to fix Uncaught Exception?

Upgrade next to version 12.2.4 or higher.

>=12.2.3 <12.2.4